ZEKASTRA

SecurityAccount management

4723 · An attempt was made to change an account's password

Generated when a user attempts to change his or her own password. A failure is logged when the new password does not meet policy (and, for local accounts, when the old password is wrong).

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

Subject and target are normally the same account. Distinguish from 4724, where one account resets another's password.

03Caveats

Requires Audit User Account Management. For domain accounts, a wrong old password is recorded on the domain controller as 4771 or 4776 rather than as a 4723 failure.

05Sources

  1. Microsoft Learn — 4723(S, F) An attempt was made to change an account's password checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.